Linux Forensics Inspection and Incident Response at Scale

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.



3 days

Delivery Method




Seats Available



DATE: 11-13 May 2022

TIME: 09:00 to 17:00 SGT/GMT +8

Date Day Time Duration
11 May Wednesday 09:00 to 17:00 SGT/GMT +8 8 Hours
12 May Thursday 09:00 to 17:00 SGT/GMT +8 8 Hours
13 May Friday 09:00 to 17:00 SGT/GMT +8 8 Hours


Full access to the PurpleLabs environment for 30 days post-training!

Through the hands-on labs, you will gain a perfect understanding of important DFIR Linux/Network internals and investigation steps needed to get the full picture of post-exploitation activities and artifacts left behind. At scale.

Attackers constantly find new ways to attack and infect Linux boxes using more and more sophisticated techniques and tools. As defenders we need to stay up to date with adversaries, understand their TTPs and be able to respond quickly. The combination of low-level network and endpoint visibility is crucial to achieve that goal. For DFIR needs we could go even further with proactive forensics inspections. This training will guide you through different attack-detection-inspection-response use-cases and teach critical aspects of how to handle Linux incidents properly.

Topics Covered
  • Introduction to PurpleLabs Hunting and Detection tools including Velociraptor, Wazuh, HELK+Sigma, Splunk, Elastiflow, Moloch/Arkime, Kolide Fleet, Graylog, theHive, Sandfly and more
  • Linux profile baselining
  • How to run DFIR tasks at scale across many Linux endpoints
  • Recent Linux APT analysis
  • RE&CT Enterprise Matrix
  • The importance of timeline analysis and NTP synchronization
  • Triage / collecting artifacts
  • Privileged user and group enumeration
  • Identification of logged accounts
  • Searching for files at scale
  • Establishing a baseline for different OS components (cron, at, rc.local, ACLs, hosts, resolv.conf, SELinux, filesystem hashing, packages and checksums)
  • Process call chains / pstree / process arguments
  • Collecting and analyzing important process data (/proc)
  • Finding hidden processes, network connections and kernel modules
  • Detecting capabilities in ELF, shellcode files
  • Detecting loaded shared libraries per process
  • Dropping web shells vs File Integrity Monitoring
  • Hunting for packers, extracting binary versions and exports
  • Searching for exploitation attempts in logs
  • Hunting for Linux rootkits (user space / kernel space)
  • Hunting for artifacts of process injection techniques
  • Sysmon Events + Linux Sigma detection rules
  • Runtime Security Analysis (Falco, Tracee) for host and docker containers
  • Syscall filtering
  • Open source ways for memory acquisition and memory forensics
  • Creating Volatility profiles
  • Filesystem and Linux process memory yara scans
  • Linux Endpoint data correlation and hunting for suspicious network events
  • Network visibility with / without signature rules
  • Searching for different persistence methods in use
  • Data correlation and hunting for suspicious network events + RITA
  • Direct interaction with endpoint: command execution on demand, system modification and active quarantine examples
  • Hunts enrichment
  • Using theHive for incident management

Leszek Miś

Leszek Miś is the Founder of Defensive Security (​​), Principal Trainer and Security Researcher with over 16 years of experience in Cyber Security and Open Source Security Solutions market. He went through the full path of the infosec carrier positions: from OSS researcher, Linux administrator, and system developer and DevOps, through penetration tester and security consultant delivering hardening services and training for the biggest players in the European and global market, to become finally an IT Security Architect / SOC Security Analyst with deep non-vendor focus on Network Security attack and detection. He’s got deep knowledge about finding blind spots and security gaps in corporate environments. Perfectly understands technology and business values from delivering structured, automated adversary simulation platform.

Recognized speaker and trainer: BruCON 2017/2018, Black Hat USA 2019, OWASP Appsec US 2018, FloCon USA 2018, Hack In The Box Dubai / Amsterdam / Singapore / Abu Dhabi 2018/2019/2020, 44CON UK 2019, Confidence PL, PLNOG, Open Source Day PL, Secure PL, Advanced Threat Summit PL

Member of OWASP Poland Chapter.

Author of many IT Security trainings:

  • Open Source Defensive Security → The Trinity of Tactics for Defenders
  • In & Out → Network Exfiltration and Post-Exploitation Techniques [RED EDITION]
  • In & Out → Detection of Network Exfiltration and Post-Exploitation Techniques [BLUE EDITION]
  • System Internals – Network, OS and Memory Forensics
  • SELinux → Development & Administration of Mandatory Access Control Policy
  • Advanced RHEL/CentOS Defensive Security & Hardening
  • ModSecurity → Development and Management of Web Application Firewall rules
  • FreeIPA → Identity Management for Linux Domain Environments & Trusts

Holds many certifications: OSCP, RHCA, RHCSS, Splunk Certified Architect.

His areas of interest include network “features” extraction, OS internals and forensics. Constantly tries to figure out what the AI/ML Network Security vendors try to sell. In free time he likes to break into “IoT world” just for fun. Still learning hard every single day.


What students say about this training:

"The content of in and out was great. Lots of gained knowledge and hands on!"

“Great course! A truly huge number of topics and tools covered"

"Leszek was a really good trainer, he covered a lot of material, and had a very good personality."

"Leszek Miś is very knowledgeable in the topics covered in the course. He also shares real life scenarios which were useful for participants to better understand application of material presented. The content was very good, it covers many leading open source projects which I find useful. I would recommend this course to my colleagues"


PurpleLabs Values:

This training is based on the PurpleLabs Cyber Range Playground. It’s a dedicated, virtual infrastructure for detecting and analyzing the behavior of attackers in terms of the techniques, tactics, procedures, and used offensive tools. The environment is to serve the continuous improvement of competences in the field of threat hunting and learning about current trends from offensive scope (red-teaming) vs direct detection perspective (blue-teaming) and DFIR. By providing high-quality training materials with the lab environment in a scalable online format, we want to enable businesses to improve the detection capacity of their SOC teams and achieve better visibility and resistance to attacks. Having hands dirty with PurpleLabs will allow you to:

  • Develop the team's analytical skills required to work in the Security Operation Center environment
  • Increase awareness of the complexity and dependencies between the elements of the APT campaigns, malware and the areas of detection
  • Deliver a periodic knowledge transfer and systematic expansion of team competences in the field of Red + Blue = Purple teaming
  • Acquire Attack Paths / Attack Lifecycles and Security Event Chains skills by combining attacker’s single techniques, tactics and procedures (Chain Attack Scenarios)
  • Understand the value of the Assume Breach approach and simulation of threats after early access (C2, post-exploitation, Lateral Movement, Persistence, Evasion)
  • Understand what threat hunting is and why it is important
  • Understand proactive DFIR and why it is important
  • Acquire skills related to generating suspicious events on the layer of network and Windows and Linux operating systems and methods of their detection
  • Understand the potential of Sigma rules and their values for SIEM solutions.
  • Run a validation of the current security status of the organization's network and the risks involved
  • Obtain knowledge on supplying/creating a complete SOC environment using Open Source software.


About Defensive Security

Defensive Security delivers high-quality cyber security services including Linux / Windows digital forensics, incident response, latest threat analysis, and hunting, penetration testing, and infrastructure hardening. We successfully deliver a combination of Threat/Adversary Emulations vs network/endpoint investigations and log analysis at scale which is known as Purple Teaming.

Defensive Security offers advanced, hands-on cyber security training programs backed by PurpleLabs - a fully customized Cyber Range Environment enriched by step-by-step offensive/defensive lab instructions. Want to sharpen your Purple team skills? Try PurpleLabs where you will be playing with chained attack paths, emulating attacker's TTPs, and running detection/response at the same time by using Sysmon and EVTX, Auditd, Wazuh, Graylog, HELK, ElastAlert, Falco, OSQuery, Velociraptor, Zeek, Suricata, Moloch FPC, Volatility Framework, theHive, MISP, and Sigma Rules.

Our mission is to help organizations have more secure infrastructures, better utilize Open Source software in Security Operations, and enable businesses to improve the detection capacity and skills of their SOC/IR teams.

We are trusted by the biggest customers from the private, oil and gas, insurance, and financial sector. It was an honor for us to conduct training workshops during the biggest conferences including Hack In The Box, BruCON, 44CON, OWASP AppSec US, and Black Hat US.

Our almost 20 years of hands-on experience with Open Source Security Solutions go directly into the full spectrum of technology solutions to support customers achieving better visibility and detections, improving offensive and defensive Red / Blue and Purple team skills, validating defensive technology stacks, and helping understand the value of the Assume Breach approach and emulation of threats after getting initial access (C2, post-exploitation, Lateral Movement, Persistence, Evasion).

Why You Should Take This Course

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.

Who Should Attend

  • CSIRT / Incident Response Specialists
  • Red and Blue team members
  • Penetration testers
  • Threat Hunters
  • Security / Data Analytics
  • IT Security Professionals, Experts & Consultants
  • SOC Analysts and SIEM Engineers
  • AI / Machine Learning Developers
  • Open Source Security Enthusiasts

Key Learning Objectives

  • Get to know the newest Linux attack paths and hiding techniques vs proactive detection

  • Learn current trends, techniques, and offensive tools for Discovery, C2, Lateral Movement, Persistence, Evasion, Exfiltration, Execution, Credential Access against Linux machines ← Linux Matrix ATT&Ck Framework

  • Learn ways to improve detection and sharpen your event correlation skills across many different Linux/network data sources

  • Get to know visibility/detection methods and capabilities of well recognized Hunting and Detection tools including Velociraptor, HELK+Linux Sigma, Splunk, Elastiflow, Moloch/Arkime, Kolide Fleet, Wazuh, Graylog, theHive, Sandfly

  • Find the malicious Linux activities and identify threat details on the network

  • Prepare your SOC team for fast filtering out Linux network noise and allow for better incident response handling

  • Find out how Detection / DFIR Open Source Software can support your SOC infrastructure

  • Understand values of proactive linux forensics scans vs manual and automated approach to simulate attackers and generate anomalies

  • Identify Linux blind spots in your network security posture
  • Prerequisite Knowledge

    • An intermediate level of command-line syntax experience using Linux.
    • Fundament knowledge of TCP/IP network protocols.
    • Penetration testing experience performing enumeration, exploiting, and lateral movement is beneficial, but not required.
    • Basic programming skills are a plus, but not essential.

    Hardware / Software Requirements

    • This training is based on dedicated PurpleLABS virtual infrastructure so there are no special student’s desktop requirements. No more initial setup issues, just a pure training experience. Every student will gain full access to the PurpleLabs environment for 30 days after the training.
    • VPN client installed according to VPN Setup instructions or just a browser
    • Slack account as an invite to dedicated training channel will be sent
    • Stable internet connection